-
Notifications
You must be signed in to change notification settings - Fork 59
All issues
Issue creation is restricted in this repository
Issues
is:issue state:open
is:issue state:open
Search results
fix(macos-esf): User reports the real UID rather than the effective UID
bugSomething isn't workingSomething isn't workingmacosmacOS supportmacOS supportp2Useful hardening; schedule when capacity allowsUseful hardening; schedule when capacity allowssensorSensor and telemetry workSensor and telemetry workStatus: Open.#327 In Karib0u/rustinel;fix(windows-etw): process creation reports TargetImage as a copy of Image
bugSomething isn't workingSomething isn't workingp2Useful hardening; schedule when capacity allowsUseful hardening; schedule when capacity allowssensorSensor and telemetry workSensor and telemetry workwindowsWindows supportWindows supportStatus: Open.#326 In Karib0u/rustinel;fix(windows-etw): Details falls back to ValueName when CapturedData is unavailable
bugSomething isn't workingSomething isn't workingp1Important but not required for next cycleImportant but not required for next cyclesensorSensor and telemetry workSensor and telemetry workwindowsWindows supportWindows supportStatus: Open.#325 In Karib0u/rustinel;feat(yara): scan newly written files, not only process-start executables
enhancementNew feature or requestNew feature or requestp2Useful hardening; schedule when capacity allowsUseful hardening; schedule when capacity allowssensorSensor and telemetry workSensor and telemetry workyaraYARA integrationYARA integrationStatus: Open.#324 In Karib0u/rustinel;feat(windows-eventlog): add ps_classic_start via the classic PowerShell channel
enhancementNew feature or requestNew feature or requestp3Backlog; larger or lower-urgency workBacklog; larger or lower-urgency worksensorSensor and telemetry workSensor and telemetry workwindowsWindows supportWindows supportStatus: Open.#323 In Karib0u/rustinel;feat(windows-etw): add ps_module via PowerShell event 4103
enhancementNew feature or requestNew feature or requestp2Useful hardening; schedule when capacity allowsUseful hardening; schedule when capacity allowssensorSensor and telemetry workSensor and telemetry workwindowsWindows supportWindows supportStatus: Open.#322 In Karib0u/rustinel;feat(linux): add an auditd collector
enhancementNew feature or requestNew feature or requestlinuxLinux supportLinux supportp2Useful hardening; schedule when capacity allowsUseful hardening; schedule when capacity allowssensorSensor and telemetry workSensor and telemetry workStatus: Open.#321 In Karib0u/rustinel;feat(windows): add Authenticode signature enrichment
enhancementNew feature or requestNew feature or requestp2Useful hardening; schedule when capacity allowsUseful hardening; schedule when capacity allowssensorSensor and telemetry workSensor and telemetry workwindowsWindows supportWindows supportStatus: Open.#320 In Karib0u/rustinel;feat(windows): add Hashes and Imphash enrichment
enhancementNew feature or requestNew feature or requestp2Useful hardening; schedule when capacity allowsUseful hardening; schedule when capacity allowssensorSensor and telemetry workSensor and telemetry workwindowsWindows supportWindows supportStatus: Open.#319 In Karib0u/rustinel;feat(sensor): add Initiated to the network event model
enhancementNew feature or requestNew feature or requestlinuxLinux supportLinux supportp2Useful hardening; schedule when capacity allowsUseful hardening; schedule when capacity allowssensorSensor and telemetry workSensor and telemetry workwindowsWindows supportWindows supportStatus: Open.#318 In Karib0u/rustinel;feat(engine): expose Provider_Name and alias ImagePath
enhancementNew feature or requestNew feature or requestp1Important but not required for next cycleImportant but not required for next cyclesensorSensor and telemetry workSensor and telemetry workwindowsWindows supportWindows supportStatus: Open.#317 In Karib0u/rustinel;feat(windows-eventlog): add an Application channel source
enhancementNew feature or requestNew feature or requestp2Useful hardening; schedule when capacity allowsUseful hardening; schedule when capacity allowssensorSensor and telemetry workSensor and telemetry workwindowsWindows supportWindows supportStatus: Open.#316 In Karib0u/rustinel;